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Reform,  Committee  on  Armed  Services, 

House  of  Representatives 


Accountability-  Integrity  Reliability 

Highlights 


Why  GAO  Did  This  Study  What  GAO  Found 


In  fiscal  year  2008,  the  Department 
of  Defense  (DOD)  obligated  over 
$380  billion  to  federal  contractors, 
more  than  doubling  the  amount  it 
obligated  in  fiscal  year  2002.  With 
hundreds  of  billions  of  taxpayer 
dollars  at  stake,  the  government 
needs  strong  controls  to  provide 
reasonable  assurance  that  contract 
funds  are  not  being  lost  to  fraud, 
waste,  abuse,  and  mismanagement. 

The  Defense  Contract  Audit 
Agency  (DCAA)  is  charged  with  a 
critical  role  in  contractor  oversight 
by  providing  auditing,  accounting, 
and  financial  advisory  services  in 
connection  with  DOD  and  other 
federal  agency  contracts  and 
subcontracts.  However,  last  year 
GAO  found  numerous  problems 
with  DCAA  audit  quality  at  three 
locations  in  California,  including 
the  failure  to  meet  professional 
auditing  standards.  In  a  follow-up 
audit  issued  this  September,  GAO 
found  that  these  problems  existed 
agencywide. 

Today’s  testimony  describes 
widespread  audit  quality  problems 
at  DCAA  and  provides  information 
about  continuing  contract 
management  challenges  at  DOD, 
which  underscore  the  importance 
of  DCAA  audits  that  meet 
professional  standards.  It  also 
discusses  some  of  the  corrective 
actions  taken  by  DCAA  and  DOD 
and  key  GAO  recommendations  to 
improve  DCAA  audit  quality. 


GAO  found  substantial  evidence  of  widespread  audit  quality  problems  at 
DCAA.  In  the  face  of  this  evidence,  DOD,  Congress,  and  American  taxpayers 
lack  reasonable  assurance  that  billions  of  dollars  in  federal  contract  payments 
are  being  appropriately  scrutinized  for  fraud,  waste,  abuse,  and 
mismanagement.  An  initial  investigation  of  hotline  allegations  at  three  DCAA 
field  office  locations  in  California  revealed  that  all  14  audits  and  62  forward 
pricing  reports  GAO  examined  were  not  performed  in  accordance  with 
professional  auditing  standards.  For  example,  while  auditing  the  satellite 
launch  proposal  for  a  major  U.S.  defense  contractor,  a  DCAA  manager 
experienced  pressure  from  the  contractor  and  the  DOD  buying  command  to 
drop  adverse  findings.  The  manager  directed  his  auditors  to  drop  the  findings, 
and  DCAA  issued  a  more  favorable  opinion,  allowing  the  contractor  to  win  a 
contract  that  improperly  compensated  the  contractor  for  hundreds  of  millions 
of  dollars  in  commercial  business  losses.  Specifically,  of  $271  million  in 
unallowable  costs  related  to  commercial  losses,  the  contractor  has  already 
been  paid  $101  million.  This  incident  is  under  criminal  investigation  by  the 
DOD  Inspector  General  (IG). 

In  September  of  this  year,  GAO  followed  up  on  its  initial  investigation  and 
identified  audit  quality  problems  agencywide  at  DCAA.  Audit  quality  problems 
included  insufficient  audit  testing,  inadequate  planning  and  supervision,  and 
the  compromise  of  auditor  independence.  For  example,  of  the  69  audits  and 
cost-related  assignments  GAO  reviewed,  65  exhibited  serious  deficiencies  that 
rendered  them  unreliable  for  decisions  on  contract  awards,  management,  and 
oversight.  DCAA  has  rescinded  81  audit  reports  to  date  as  a  result  of  GAO’s 
and  DOD  IG’s  work.  Because  the  rescinded  reports  were  used  to  assess  risk  in 
planning  subsequent  audits,  they  affect  the  reliability  of  hundreds  of  other 
audits  and  contracting  decisions  covering  billions  of  dollars  in  DOD  contract 
expenditures.  GAO  determined  that  quality  problems  are  widespread  because 
DCAA’s  management  environment  and  quality  assurance  structure  were  based 
on  a  production-oriented  mission  that  prevented  DCAA  from  protecting  the 
public  interest  while  also  facilitating  DOD  contracting. 

GAO  has  designated  both  contract  management  and  weapon  systems 
acquisition  as  high-risk  areas  since  the  early  1990s.  DOD  acquisition  and 
contract  management  weaknesses  create  vulnerabilities  to  fraud,  waste, 
abuse,  and  mismanagement  that  leave  hundreds  of  billions  of  taxpayer  dollars 
at  risk,  and  underscore  the  importance  of  a  strong  contract  audit  function. 


In  preparing  this  testimony,  GAO 
drew  from  issued  reports  and 
testimonies.  These  products 
contained  statements  regarding  the 
scope  and  methodology  GAO  used. 

View  GAO-1 0-1 63T  or  key  components. 

For  more  information,  contact  Gregory  D. 
Kutz  at  (202)  512-6722  or  kutzg@gao.gov. 


In  response  to  GAO’s  findings  and  recommendations,  DCAA  has  taken  several 
steps  to  improve  metrics,  policies,  and  processes,  and  the  DOD  Comptroller 
has  established  a  DCAA  oversight  committee.  To  ensure  quality  audits  for 
contractor  oversight  and  accountability,  DOD  and  DCAA  will  also  need  to 
address  the  fundamental  weaknesses  in  DCAA’s  mission,  strategic  plan, 
metrics,  audit  approach,  and  human  capital  practices  that  have  had  a 
detrimental  effect  on  audit  quality. 


United  States  Government  Accountability  Office 


Mr.  Chairman  and  Members  of  the  Panel: 


Thank  you  for  the  opportunity  to  discuss  our  work  related  to  the  Defense 
Contract  Audit  Agency  (DCAA).  DCAA  is  charged  with  a  critical  role  in 
DOD  and  other  federal  agency  contractor  oversight  by  providing  auditing, 
accounting,  and  financial  advisory  services  in  connection  with  the 
negotiation,  administration,  and  settlement  of  contracts  and  subcontracts. 
DCAA  contract  audits  are  intended  to  be  a  key  control  to  help  ensure  that 
prices  paid  by  the  government  for  needed  goods  and  services  are  fair  and 
reasonable  and  that  contractors  are  charging  the  government  in 
accordance  with  applicable  laws,  the  Federal  Acquisition  Regulation 
(FAR),  Cost  Accounting  Standards  (CAS),  and  contract  terms.  DCAA’s 
mission  encompasses  both  audit  and  nonaudit  services  in  support  of  DOD 
contracting  and  contract  payment  functions. 

The  majority  of  DCAA  audits  focus  on  cost-reimbursable  and  other 
flexibly  priced  contracts,  including  progress  payments  on  major  weapon 
systems  and  time-and-materials  contracts.  These  contract  types  pose  the 
highest  risk  to  the  government  because  the  government  has  agreed  to  pay 
the  actual  incurred  cost,  plus  profit.  DCAA  audits  of  contractor  business 
systems  and  related  internal  controls  support  decisions  on  pricing, 
contract  awards,  and  billing.  For  example,  the  FAR  requires  government 
contracting  officers  to  determine  the  adequacy  of  a  contractor’s 
accounting  system  before  awarding  a  cost-reimbursement  or  other  flexibly 
priced  contract.1  Audits  of  estimating  system  controls  support  negotiation 
of  fair  and  reasonable  prices.2  Also,  billing  system  audits  support  decisions 
to  authorize  contractors  to  submit  invoices  directly  to  DOD  payment 
offices  for  payment  without  government  review.3  Internal  control  audits 
also  impact  the  planning  and  reliability  of  other  DCAA  audits,  such  as 
audits  of  contractors’  pricing  proposals  and  annual  incurred  cost  claims, 
because  DCAA  uses  the  results  of  its  internal  control  audits  to  assess  risk 
and  plan  the  nature,  extent,  and  timing  of  tests  for  these  audits. 

Since  the  early  1990s,  we  have  reported  DOD  weapon  systems  acquisition 
and  contract  management  as  high-risk  areas.4  DOD  acquisition  and 


1  FAR  §§  16.104(h)  and  16.301-3(a)(l). 

2  DCAA,  Contract  Audit  Manual  (CAM)  6-1202.1. a  and  Defense  Federal  Acquisition 
Regulation  Supplement  (DFARS)  216.407-5. 

3  FAR  §  42.101  and  DFARS  §  242.803. 

4  GAO,  High-Risk  Series:  An  Update,  GAO-09-271  (Washington,  D.C.:  January  2009). 
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contract  management  weaknesses  create  vulnerabilities  that  leave 
hundreds  of  billions  of  taxpayer  dollars  at  risk,  and  underscore  the 
importance  of  a  strong  contract  audit  function.  Every  dollar  wasted  during 
the  development  and  acquisition  of  weapon  systems  is  money  that  is  not 
available  for  other  priorities  within  DOD  and  across  the  government. 

Today,  I  will  discuss  the  findings  from  our  two  recent  DCAA  reports  and 
note  some  of  the  challenges  in  DOD’s  contract  management  that  make 
DCAA  audits  a  key  control  for  assuring  that  prices  paid  by  the  government 
for  needed  goods  and  services  are  fair  and  reasonable  and  that  contractors 
are  not  overcharging  the  government.  I  will  conclude  by  highlighting  some 
of  the  recent  actions  taken  by  DCAA  and  DOD  and  key  recommendations 
we  have  made  to  improve  DCAA  audit  quality. 

In  preparing  this  testimony,  we  relied  on  the  work  we  performed  during 
our  DCAA  hotline  investigations  and  our  DCAA  performance  audit,  as  well 
as  our  extensive  body  of  work  on  DOD’s  contract  management.  A  list  of 
these  products  is  provided  at  the  end  of  this  testimony.  Our  audit  work 
was  conducted  in  accordance  with  generally  accepted  government 
auditing  standards  (GAGAS).  Those  standards  require  that  we  plan  and 
perform  our  audits  to  obtain  sufficient,  appropriate  evidence  to  provide  a 
reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit 
objectives.  We  believe  that  the  evidence  obtained  provides  a  reasonable 
basis  for  our  findings  and  conclusions  based  on  our  audit  objectives.  We 
performed  our  investigative  procedures  in  accordance  with  quality 
standards  set  forth  by  the  Council  of  the  Inspectors  General  on  Integrity 
and  Efficiency  (formerly  the  President’s  Council  on  Integrity  and 
Efficiency). 


Widespread  DCAA 
Management 
Environment  and 
Audit  Quality 
Problems 


Our  investigation  of  DCAA  hotline  allegations  and  our  DCAA-wide  follow¬ 
up  audit  document  systemic  weaknesses  in  DCAA’s  management 
environment  and  structure  for  assuring  audit  quality.  Last  year,  our 
investigation  of  hotline  allegations5  substantiated  auditor  concerns  made 
on  all  14  audits  we  reviewed  at  two  locations  and  62  forward  pricing 
reports  we  investigated  at  a  third  location.  We  found  that  (1)  workpapers 
did  not  support  reported  opinions,  (2)  DCAA  supervisors  dropped  findings 
and  changed  audit  opinions  without  adequate  audit  evidence  for  their 


5  GAO,  DCAA  Audits:  Allegations  That  Certain  Audits  at  Three  Locations  Did  Not  Meet 
Professional  Standards  Were  Substantiated,  GAO-08-857  (Washington,  D.C.:  July  22,  2008). 
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changes,  and  (3)  sufficient  audit  work  was  not  performed  to  support  audit 
opinions  and  conclusions.  In  addition,  we  found  that  contractor  officials 
and  the  DOD  contracting  community  improperly  influenced  the  audit 
scope,  conclusions,  and  opinions  of  some  audits — a  serious  independence 
issue.  This  year,  our  follow-on  audit6  found  DCAA-wide  audit  quality 
problems  similar  to  those  identified  in  our  investigation,  including 
compromise  of  auditor  independence,  insufficient  audit  testing  to  support 
conclusions  and  opinions,  and  inadequate  planning  and  supervision. 

For  example,  of  the  69  audits  and  cost-related  assignments  we  reviewed,7 
65  exhibited  serious  GAGAS  and  other  deficiencies  that  rendered  them 
unreliable  for  decisions  on  contract  awards  and  contract  management  and 
oversight.  Although  not  as  serious,  the  remaining  four  audits  also  had 
GAGAS  compliance  problems.  Of  the  69  audits  and  cost-related 
assignments,  37  covered  key  contractor  business  systems  and  related 
controls,  including  cost  accounting,  estimating,  and  billing  systems. 
Contracting  officers  rely  on  the  results  of  these  audits  for  3  or  more  years 
to  make  decisions  on  pricing,  contract  awards,  and  payments.  In  addition, 
while  DCAA  did  not  consider  26  of  the  32  cost-related  assignments  we 
reviewed  to  be  GAGAS  audits,  DCAA  did  not  perform  sufficient  testing  to 
support  reported  conclusions  on  that  work  related  to  contractor  billings. 

DCAA  has  rescinded  81  audit  reports  in  response  to  our  work  and  the 
DOD  Inspector  General’s  (IG)  follow-up  audit  because  the  audit  evidence 
was  outdated,  insufficient,  or  inconsistent  with  reported  conclusions  and 
opinions  and  reliance  on  these  reports  for  contracting  decisions  could 
pose  a  problem.  About  one-third  of  the  rescinded  reports  relate  to 
unsupported  opinions  on  contractor  internal  controls  and  were  used  as 
the  basis  for  risk-assessments  and  planning  on  subsequent  internal  control 
and  cost-related  audits.  Other  rescinded  reports  relate  to  CAS  compliance 
and  contract  pricing  decisions.  Because  the  conclusions  and  opinions  in 
the  rescinded  reports  were  used  to  assess  risk  in  planning  subsequent 
audits,  they  impact  the  reliability  of  hundreds  of  other  audits  and 
contracting  decisions  covering  billions  of  dollars  in  DOD  expenditures. 


6  GAO,  DCAA  Audits:  Widespread  Problems  with  Audit  Quality  Require  Significant 
Reform,  GAO-09-468  (Washington,  D.C.:  Sept.  23,  2009). 

'  Of  the  69  DCAA  assignments  we  reviewed,  37  were  audits  of  contractor  systems  and 
related  internal  controls  and  32  were  cost  related  audits  and  assignments. 
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Investigation  of  Hotline 
Allegations  Identified 
Serious  Audit  Deficiencies 


Our  hotline  investigation  found  numerous  examples  where  DCAA  failed  to 
comply  with  GAGAS.  For  example,  contractor  officials  and  the  DOD 
contracting  community  improperly  influenced  the  audit  scope, 
conclusions  and  opinions,  and  reporting  in  three  cases  we  investigated — a 
serious  independence  issue.  For  14  audits  at  two  DCAA  locations,  we 
found  that  (1)  audit  documentation  did  not  support  the  reported  opinions, 
(2)  DCAA  supervisors  dropped  findings  and  changed  audit  opinions 
without  adequate  evidence  for  their  changes,  and  (3)  sufficient  audit  work 
was  not  performed  to  support  audit  opinions  and  conclusions.  We  also 
substantiated  allegations  that  forward  pricing  audit  reports  at  a  third 
DCAA  location  were  issued  before  supervisors  completed  their  review  of 
the  audit  documentation  because  of  the  20-  to  30-day  time  frames  required 
to  support  contract  negotiations. 

Throughout  our  investigation,  auditors  at  each  of  the  three  locations 
addressed  in  the  hotline  allegations  told  us  that  the  limited  number  of 
hours  approved  for  their  audits  directly  affected  the  sufficiency  of  audit 
testing.  Deficient  audits  do  not  provide  assurance  that  billions  of  dollars  in 
annual  payments  to  these  contactors  complied  with  the  FAR,  CAS,  or 
contract  terms.  We  also  found  that  DCAA  managers  took  actions  against 
staff  at  two  locations,  attempting  to  intimidate  auditors,  prevent  them 
from  speaking  with  investigators,  and  creating  a  generally  abusive  work 
environment.  The  following  discussion  highlights  some  of  the  examples 
from  our  investigation. 

•  In  planning  an  estimating  system  audit  of  a  major  aerospace  company, 
DCAA  made  an  up-front  agreement  with  the  contractor  to  limit  the 
scope  of  work  and  basis  for  the  audit  opinion.  The  contractor  was 
unable  to  develop  compliant  estimates,  leading  to  a  draft  audit  opinion 
of  “inadequate-in-part.”  The  contractor  objected  to  the  draft  findings, 
and  DCAA  management  assigned  a  new  supervisory  auditor.  DCAA 
management  then  threatened  the  senior  auditor  with  personnel  action 
if  he  did  not  delete  the  findings  from  the  report  and  change  the  draft 
audit  opinion  to  “adequate.” 

•  Another  audit  of  the  above  contractor  related  to  a  revised  proposal  that 
was  submitted  after  DCAA  had  reported  an  “adverse”  (inadequate) 
opinion  on  the  contractor’s  2005  proposal  to  provide  commercial 
satellite  launch  capability.  At  the  beginning  of  the  audit,  the  buying 
command  and  contractor  officials  met  with  a  DCAA  regional  audit 
manager  to  determine  how  to  resolve  CAS  compliance  issues  and 
obtain  a  favorable  audit  opinion.  Although  the  contractor  failed  to 
provide  all  cost  information  requested  for  the  audit,  the  DCAA 
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regional  audit  manager  (RAM)  instructed  the  auditors  that  they  could 
not  base  an  “adverse”  opinion  on  the  lack  of  information  to  audit 
certain  costs.  The  manager  directed  the  auditors  to  exclude  any 
reference  to  CAS  noncompliance  in  the  audit  documentation  and  to 
change  the  audit  opinion  to  “inadequate-in-part.”  Based  on  the  more 
favorable  audit  opinion,  the  buying  command  negotiated  a  $967  million 
contract  which  has  since  grown  to  over  $1.6  billion  through  fiscal  year 
2009.  The  Defense  Criminal  Investigative  Service  is  completing  a 
criminal  investigation  conducted  in  response  to  our  findings. 

The  DOD  IG  performed  a  follow-up  audit  and  confirmed  our  findings 
that  DCAA’s  audit  was  impaired  because  of  a  lack  of  independence;  the 
audit  working  papers  did  not  support  the  reported  opinions  in  the 
May  8,  2006,  proposal  audit  report;  and  the  draft  audit  opinion  was 
changed  without  sufficient  documentation.  In  addition,  the  DOD  IG 
concluded  that  the  DCAA  RAM  failed  to  exercise  objective  and 
impartial  judgment  on  significant  issues  associated  with  conducting  the 
audit  and  reporting  on  the  work — a  significant  independence 
impairment — and  that  the  RAM  did  not  protect  the  interests  of  the 
government  as  required  by  DCAA  policy.  The  DOD  IG  also  concluded 
that  the  contractor’s  unabsorbed  Program  Management  and  Hardware 
Support  (PM&HS)  costs  represented  losses  incurred  on  other  contracts 
and  prior  accounting  periods,  including  commercial  losses — a  CAS 
noncompliance.  The  DOD  IG  recommended  that  the  Air  Force  buying 
command  withhold  the  balance  of  $271  million  for  unabsorbed  PM&HS 
costs  (of  which  $101  million  had  already  been  paid)  and  that  the  Air 
Force  cease  negotiations  with  the  launch  services  contractor  on  a  $114 
million  proposal  for  unabsorbed  costs.  DCAA  is  currently  performing 
CAS  compliance  audits  on  the  commercial  satellite  launch  contract 
costs.  If  DCAA  determines  that  the  contractor’s  costs  did  not  comply 
with  CAS  related  to  unallowable  costs,8  cost  accounting  period,9  and 
allocation  of  direct  and  indirect  cost, 10  and  the  FAR  related  to  losses  on 


8  FAR  9904.405-40  provides  generally  that  unallowable  costs  shall  be  separately  identified 
and  be  excluded  from  any  billing,  claim,  or  proposal  on  a  government  contract. 

9  FAR  9904.406-40a  states  that  a  contractor  generally  is  to  use  a  fiscal  year  as  its  cost 
accounting  period. 

10  FAR  9904.418-20  states  the  purpose  of  CAS  418,  which  is  to  provide  for  consistent 
determination  of  direct  and  indirect  costs;  to  provide  criteria  for  the  accumulation  of 
indirect  costs;  and  to  provide  guidance  on  selection  of  allocation  measures  between  an 
indirect  cost  pool  and  cost  objectives. 
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other  contracts,11  DCAA  findings  should  provide  the  basis  for 
recovering  amounts  already  paid. 

•  For  a  billing  system  audit  of  a  contractor  with  $168  million  in  annual 
billings  to  the  government,  the  field  office  manager  allowed  the  original 
auditor  to  work  on  the  audit  after  being  assured  that  the  auditors 
would  help  the  contractor  correct  billing  system  deficiencies  during  the 
performance  of  the  audit.  After  the  original  auditor  identified  10 
significant  billing  system  deficiencies,  the  manager  removed  her  from 
the  audit  and  assigned  a  second  auditor  who  then  dropped  8  of  the  10 
significant  deficiencies  and  reported  one  significant  deficiency  and  one 
suggestion  to  improve  the  system.  The  final  opinion  was  “inadequate- 
in-part.”  However,  the  DCAA  field  office  retained  the  contractor’s 
direct  billing  privileges — a  status  conveyed  to  a  contractor  based  on 
the  strength  of  its  billing  system  controls  whereby  invoices  are 
submitted  directly  to  the  government  paying  office  without  prior 
review.  After  we  brought  this  to  the  attention  of  DCAA  western  region 
officials,  the  field  office  rescinded  the  contractor’s  direct  billing  status. 


DCAA- wide  Audit 
Identified  Widespread 
Audit  Quality  Problems 
Requiring  Significant 
Reform 


Our  follow-up  audit  found  that  a  management  environment  and  agency 
culture  that  focused  on  facilitating  the  award  of  contracts  and  an 
ineffective  audit  quality  assurance  structure  are  at  the  root  of  the  DCAA- 
wide  audit  failures  that  we  identified  for  the  69  audits  and  cost  related 
assignments  that  we  reviewed.  DCAA’s  focus  on  a  production-oriented 
mission  led  DCAA  management  to  establish  policies,  procedures,  and 
training  that  emphasized  performing  a  large  quantity  of  audits  to  support 
contracting  decisions  and  gave  inadequate  attention  to  performing  quality 
audits.  An  ineffective  quality  assurance  structure,  whereby  DCAA  gave 
passing  scores  to  deficient  audits  compounded  this  problem.  Although  the 
reports  for  all  37  audits  of  contractor  internal  controls  that  we  reviewed 
stated  that  the  audits  were  performed  in  accordance  with  GAGAS,  we 
found  GAGAS  compliance  issues  with  all  of  these  audits.  The  issues  or 
themes  are  consistent  with  those  identified  in  our  prior  investigation. 

Lack  of  independence.  In  seven  audits,  independence  was  compromised 
because  auditors  provided  material  nonaudit  services  to  a  contractor  they 
later  audited;  experienced  access  to  records  problems  that  were  not  fully 
resolved;  and  significantly  delayed  report  issuance,  which  allowed  the 
contractors  to  resolve  cited  deficiencies  so  that  they  were  not  included  in 


11  FAR  31.205-23. 


Page  6 


GAO-10-163T 


the  audit  reports.  GAGAS  state  that  auditors  should  be  free  from 
influences  that  restrict  access  to  records  or  that  improperly  modify  audit 
scope.12 

Insufficient  testing.  Thirty-three  of  37  internal  control  audits  did  not 
include  sufficient  testing  of  internal  controls  to  support  auditor 
conclusions  and  opinions.  GAGAS  for  examination-level  attestation 
engagements  require  that  sufficient  evidence  be  obtained  to  provide  a 
reasonable  basis  for  the  conclusion  that  is  expressed  in  the  report. 13  For 
internal  control  audits,  which  are  relied  on  for  2  to  4  years  and  sometimes 
longer,  the  auditors  would  be  expected  to  test  a  representative  selection  of 
transactions  across  the  year  and  not  transactions  for  just  1  day,  1  month, 
or  a  couple  of  months. 14  However,  we  found  that  for  many  controls,  the 
procedures  performed  consisted  of  documenting  the  auditors’ 
understanding  of  controls,  and  the  auditors  did  not  test  the  effectiveness 
of  the  implementation  and  operation  of  controls  at  all. 

Unsupported  opinions.  The  lack  of  sufficient  support  for  the  audit 
opinions  on  33  of  the  37  internal  control  audits  we  reviewed  rendered 
them  unreliable  for  decision  making  on  contract  awards,  direct-billing 
privileges,  the  reliability  of  cost  estimates,  and  reported  direct  cost  and 
indirect  cost  rates. 

Similarly,  the  32  cost-related  assignments  we  reviewed15  did  not  contain 
sufficient  testing  to  provide  reasonable  assurance  that  overpayments  and 
billing  errors  that  might  have  occurred  were  identified.  As  a  result,  there  is 
limited  assurance  that  any  such  errors,  if  they  occurred,  were  corrected 
and  that  related  improper  contract  payments,  if  any,  were  refunded  or 
credited  to  the  government.  Contractors  are  responsible  for  ensuring  that 
their  billings  reflect  fair  and  reasonable  prices  and  contain  only  allowable 
costs,  and  taxpayers  expect  DCAA  to  review  these  billings  to  provide 


12  See  GAO,  Government  Auditing  Standards-.  2003  Revision,  GAO-03-673G,  (Washington, 
D.C.:  June  2003)  §  3.19,  and  GAO,  Government  Auditing  Standards :  2007  Revision, 
GAO-07-731G,  (Washington,  D.C.:  July  2007),  07-731G,  §  3.10. 

13  GAO-03-673G,  §  6.04b. 

14  American  Institute  of  Certified  Public  Accountants,  Statements  on  Auditing  Standards, 
AU  350  and  Audit  and  Accounting  Guide:  Audit  Sampling,  §§  3.14,  3.29-3.34,  3.58,  and 
3.61. 

15  The  32  cost-related  audits  included  4  incurred  cost  audits,  2  audits  of  requests  for 
equitable  adjustment,  16  paid  voucher  reviews,  and  10  overpayment  assignments. 
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reasonable  assurance  that  the  government  is  not  paying  more  than  it 
should  for  goods  and  services.  Based  on  our  findings  that  sufficient 
voucher  testing  was  not  performed  to  support  decisions  to  approve 
contractors  for  direct-billing  privileges,  DCAA  recently  removed  over  200 
contractors  from  the  direct-bill  program. 

Production  environment  and  audit  quality  issues.  DCAA’s  mission 
statement,  strategic  plan,  and  metrics  all  focused  on  producing  a  large 
number  of  audit  reports  and  provided  little  focus  on  assuring  quality  audits 
that  protect  taxpayer  interest.  For  example,  DCAA’s  current  approach  of 
performing  30,000  or  more  audits  annually  and  issuing  over  22,000  audit 
reports  with  3,600  auditors  substantially  contributed  to  the  widespread 
audit  quality  problems  we  identified.  Within  this  environment,  DCAA’s 
audit  quality  assurance  program  was  not  properly  implemented,  resulting 
in  an  ineffective  quality  control  process  that  accepted  audits  with 
significant  deficiencies  and  noncompliance  with  GAGAS  and  DCAA  policy. 
Moreover,  even  when  DCAA’s  quality  assurance  documentation  showed 
evidence  of  serious  deficiencies  within  individual  offices,  those  offices 
were  given  satisfactory  ratings.  Considering  the  large  number  of  DCAA 
audit  reports  issued  annually  and  the  reliance  the  contracting  and  finance 
communities  have  placed  on  DCAA  audit  conclusions  and  opinions,  an 
effective  quality  assurance  program  is  key  to  protecting  the  public 
interest.  Such  a  program  would  report  review  findings  along  with 
recommendations  for  any  needed  corrective  actions;  provide  training  and 
additional  policy  guidance,  as  appropriate;  and  perform  follow-up  reviews 
to  assure  that  corrective  actions  are  taken.  GAGAS  require  that  each  audit 
organization  performing  audits  and  attestation  engagements  in  accordance 
with  GAGAS  should  have  a  system  of  quality  control  that  is  designed  to 
provide  the  audit  organization  with  reasonable  assurance  that  the 
organization  and  its  personnel  comply  with  professional  standards  and 
applicable  legal  and  regulatory  requirements,  and  have  an  external  peer 
review  at  least  once  every  3  years.16  On  September  1,  2009,  the  DCAA 
Director  advised  us  that  DCAA  needs  up  to  2  years  to  revise  its  current 
audit  approach  and  establish  an  adequate  audit  quality  control  system 
before  undergoing  another  peer  review. 


16  GAO-07-73 1G,  §§  3.50-3.52. 
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Contract  Management 
Issues  That  Require 
Greater  Oversight 


For  fiscal  year  2008,  DOD  reported  that  it  obligated  over  $380  billion  for 
payments  to  federal  contractors,  more  than  double  the  amount  it  obligated 
for  fiscal  year  2002.  With  hundreds  of  billions  in  taxpayer  dollars  at  stake, 
the  government  needs  strong  controls  to  provide  reasonable  assurance 
that  these  contract  funds  are  not  being  lost  to  fraud,  waste,  abuse,  and 
mismanagement.  Moreover,  effective  contract  audit  capacity  is 
particularly  important  as  DOD  continues  its  use  of  high-risk  contracting 
strategies.  For  example,  we  have  found  numerous  issues  with  DOD’s  use 
of  time-and-materials  contracts, 17  which  are  used  to  purchase  billions  of 
dollars  of  services  across  the  government.  Under  these  types  of  contracts, 
payments  to  contractors  are  based  on  the  number  of  labor  hours  billed  at  a 
fixed  hourly  rate — which  includes  wages,  overhead,  and  profit — and  the 
cost  of  any  materials.  These  contracts  are  considered  high  risk  for  the 
government  because  the  contractor’s  profit  is  tied  to  the  number  of  hours 
worked.  Because  the  government  bears  the  responsibility  for  managing 
contract  costs,  it  is  essential  that  the  government  be  assured,  using  DCAA 
as  needed,  that  the  contractor  has  a  good  system  in  place  to  keep  an 
accurate  accounting  of  the  number  of  hours  billed  and  materials  acquired 
and  used. 


In  addition,  we  have  said  that  DOD  needs  to  improve  its  management  and 
oversight  of  undefinitized  contract  actions,  under  which  DOD  can 
authorize  contractors  to  begin  work  and  incur  costs  before  reaching  a  final 
agreement  on  contract  terms  and  conditions,  including  price.18  These 
contracts  are  high  risk  because  the  contractor  has  little  incentive  to 
control  costs  while  the  contract  remains  undefinitized.  In  one  case, 19  we 
found  that  the  lack  of  timely  negotiations  on  a  task  order  issued  to  restore 
Iraq’s  oil  infrastructure  increased  the  government’s  risk  when  DOD  paid 
the  contractor  nearly  all  of  the  $221  million  in  costs  questioned  by  DCAA. 


17  GAO,  Contract  Managem  ent:  Minimal  Compliance  with  New  Safeguards  for  Time-and- 
Materials  Contracts  for  Commercial  Services  and  Safeguards  Have  Not  Been  Applied  to 
GSA  Schedules  Program,  GAO-09-579  (Washington,  D.C.:  June  24,  2009)  and  Defense 
Contracting:  Improved  Insight  and  Controls  Needed  over  DOD’s  Time-and-Materials 
Contracts,  GAO-07-273  (Washington,  D.C.:  June  29,  2007). 

18  GAO,  Defense  Management:  Actions  Needed  to  Overcome  Long-standing  Challenges 
with  Weapon  Systems  Acquisition  and  Service  Contract  Management,  GAO-09-362T 
(Washington,  D.C.:  Feb.  11,  2009)  and  Defense  Contracting:  Use  of  Undefinitized  Contract 
Actions  Understated  and  Definitization  Time  Frames  Often  Not  Met,  GAO-07-559 
(Washington,  D.C.:  June  19,  2007). 

19  GAO,  Defense  Contract  Management:  DOD’s  Lack  of  Adherence  to  Key  Contracting 
Principles  on  Iraq  Oil  Contract  Put  Government  Interests  at  Risk,  GAO-07-839 
(Washington,  D.C.:  July  31,  2007). 
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More  timely  negotiations,  including  involvement  by  DCAA,  could  have 
reduced  the  risk  to  the  government  of  possible  overpayment. 


DCAA  initiated  a  number  of  actions  to  address  findings  in  our  July  2008 
report  as  well  as  findings  from  DOD  follow-up  efforts,  including  the  DOD 
Comptroller/Chief  Financial  Officer  (CFO)  August  2008  “tiger  team” 
review  and  the  Defense  Business  Board  study,  which  was  officially 
released  in  January  2009.  Examples  of  recent  DCAA  and  DOD  actions 
include  the  following. 

•  Eliminating  production  metrics  and  implementing  new  metrics 
intended  to  focus  on  achieving  quality  audits. 

•  Establishing  an  anonymous  Web  site  to  address  management  and 
hotline  issues.  In  addition,  DCAA’s  Assistant  Director  for  Operations 
has  been  proactive  in  handling  internal  DCAA  Web  site  hotline 
complaints. 

•  Revising  policy  guidance  to  address  auditor  independence,  assure 
management  involvement  in  key  decisions,  and  address  audit  quality 
issues.  DCAA  also  took  action  to  halt  auditor  participation  in  nonaudit 
services  that  posed  independence  concerns. 

•  DCAA  also  has  enlisted  assistance  from  other  agencies  to  develop  a 
human  capital  strategic  plan,  assist  in  cultural  transformation,  and 
conduct  a  staffing  study. 

Further,  in  March  2009,  the  new  DOD  Comptroller/CFO  established  a 
DCAA  Oversight  Committee  to  monitor  and  advise  on  DCAA  corrective 
actions. 

While  these  are  positive  steps,  much  more  needs  to  be  done  to  address 
fundamental  weaknesses  in  DCAA’s  mission,  strategic  plan,  metrics,  audit 
approach,  and  human  capital  practices  that  have  resulted  in  widespread 
audit  quality  problems.  DCAA’s  production-oriented  culture  is  deeply 
imbedded  and  will  likely  take  several  years  to  change.  DCAA’s  mission 
focused  primarily  on  producing  reports  to  support  procurement  and 
contracting  community  decisions  with  no  mention  of  quality  audits  that 
serve  taxpayer  interest.  Further,  DCAA’s  culture  has  focused  on  hiring  at 
the  entry  level  and  promoting  from  within  the  agency  and  most  training 
has  been  conducted  by  agency  staff,  which  has  led  to  an  insular  culture 
where  there  are  limited  perspectives  on  how  to  make  effective 
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organizational  changes.  To  address  these  issues,  our  September  2009 
report20  contained  15  recommendations  to  improve  the  quality  of  DCAA’s 
audits  and  strengthen  auditor  effectiveness  and  independence. 

Key  GAO  recommendations  relate  to  the  need  for  DCAA  to  develop  a  risk- 
based  audit  approach  and  develop  a  staffing  plan  in  order  to  match  audit 
priorities  to  available  resources.  To  develop  an  effective  risk-based  audit 
approach,  DCAA  will  need  to  work  with  key  DOD  stakeholders  to 
determine  the  appropriate  mix  of  audit  and  nonaudit  services  it  should 
perform  and  determine  what,  if  any,  of  these  responsibilities  should  be 
transferred  or  reassigned  to  another  DOD  agency  or  terminated  in  order 
for  DCAA  to  comply  with  GAGAS  requirements.  We  also  made 
recommendations  for  DCAA  to  establish  in-house  expertise  or  obtain 
outside  expertise  on  auditing  standards  to  (1)  assist  in  revising  contract 
audit  policy,  (2)  provide  guidance  on  sampling  and  testing,  and  (3)  develop 
training  on  professional  auditing  standards.  In  addition,  we  recommended 
that  DOD  conduct  an  independent  review  of  DCAA’s  revised  audit  quality 
assurance  program  and  follow-up  to  assure  that  appropriate  corrective 
actions  are  taken. 


Mr.  Chairman  and  Members  of  the  Panel,  this  concludes  my  statement.  We 
would  be  pleased  to  answer  any  questions  that  you  may  have  at  this  time. 
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20  GAO-09-468. 
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